the deterministic authoring path
gate-and-act
Agents do not invent structure — they instantiate it. Each skeleton below is a complete, valid workflow with # SLOT: markers at every decision point: route your intent, copy, fill the slots, nika check, done. Machines read the same pack at /templates/catalog.json; the originals live in the spec, conformance- gated on every push.
- 10skeletonsroute · copy · fill
- 94slot markersthe only blanks
- validevery fileconformance-gated
- sha256every copypinned, re-proven
take data, produce words, save them
- deterministic gather
- one model job
- explicit persist
watch X, act when Y
- jq extraction
- CEL skip-gate
- often zero model calls
gate-and-act.nika.yaml# SPDX-License-Identifier: Apache-2.0# yaml-language-server: $schema=https://nika.sh/spec/v1/workflow.schema.json## TEMPLATE · gate-and-act: check a condition, act only when it holds.# The default shape for monitors, alerts and threshold jobs. Often# needs ZERO model calls (pattern 1 · deterministic core).## Instantiate · copy → fill `# SLOT:` → `nika check` → repair → re-check.# Gate semantics (pick the right one · pattern 6) ·# when: SKIP gate · routing, not failure# nika:assert FAIL gate · the run is wrong, stop loudly# nika:prompt HUMAN gate · blocks until a person decidesnika: v1workflow: gate-and-act-template # SLOT: kebab-case workflow iddescription: "watch a value · act only when the condition holds" # SLOTvars: source_url: "https://api.example.com/v1/value" # SLOT: what to watch threshold: 100 # SLOT: the trigger condition valuesecrets: webhook: source: env key: ALERTS_WEBHOOK_URL # SLOT: where the act lands egress: - to: "nika:notify" host_from_self: true # the secret value IS the destination URLtasks: - id: check invoke: tool: "nika:fetch" args: url: "${{ vars.source_url }}" mode: jq jq: "." output: value: ".value" # SLOT: the jq path to the watched field - id: act depends_on: [check] when: ${{ tasks.check.value > vars.threshold }} # SLOT: the CEL condition invoke: tool: "nika:notify" # SLOT: the action · notify / write / exec args: channel: webhook target: "${{ secrets.webhook }}" message: "Threshold crossed · ${{ tasks.check.value }}" # SLOT severity: warningoutputs: value: ${{ tasks.check.value }}sha256 8e6ae3f6a33a8add… · conformance-gated upstream · source
do this for EVERY item
- runtime collection
- the full leash (max_parallel
- fail_fast
- retry)
only what changed since last run · survive bad input
- state read→diff→write
- `on_error: recover:` quarantine
research / review / open-ended
- plan-then-execute
- default-deny tools
- budgets
- typed final message
anything irreversible (deploy · send · publish)
- parallel gates
- assert
- `nika:prompt` GO
- `on_finally` record
understand a site (domain · theme · assets) from a URL
- fetch `traverse:` crawl
- one typed infer
- explicit persist
- zero exec
generate image/audio assets from a brief
- `nika:image_generate`
- `nika:jq` manifest
- local/mock provider first
call a product API: upload a file, then create from it
- fetch `multipart:` upload
- masked secrets header
- mode/jq extraction
read a system's state (docker · kubectl · gh), explain it, keep the report
- argv-array exec (provable allowlist)
- parallel reads
- exec ledger
- one artifact
The protocol is mechanical: route with the phrases above, instantiate, fill the slots, then nika check teaches anything you missed before anything runs. Try one in the playground, or install and start from a real file. Read the spec →